Uber: Lack of payment type validation in dial.uber.com allows for free rides

When a rider account had an outstanding account balance, improper validation of the payment method ID provided in the request made it possible to use an invalid payment method. As a result, it was possible to provide a non-existent payment type ID such as xyz when requesting a ride and get the tr...

Design/Logic Flaw

The Commerce Commonwealth CBA module 7.x-1.x before 7.x-1.5 for Drupal does not properly validate payments, which allows remote attackers to make a failed payment appear valid via a crafted URL, related to a "response from commweb."...

CVE-2015-7231

The Drupal Commerce Commonwealth (CBA) module for Drupal 7.x-1.x is affected by an input validation flaw in payment processing. Specifically, versions prior to 7.x-1.5 do not sufficiently validate gateway interactions, allowing a remote attacker to craft a URL that makes a failed payment appear v...